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1. Introduction 

The aim of this work is to give a very explicit way to estimate the rank of an elliptic 
curve over Q using 3-descent. We will suppose that the elliptic curve has a rational 3- 
torsion subgroup. It allows us to pick an affine model of the form y'^ = + D{ax + 6)^. 
After introducing the descent maps, we explain in section 2 how to us 3-descent. Then we 
show how to compute principal homogeneous spaces in the case D = 1 in section 3. We do 
the same in section 4 for the case D 1, which is a bit more technical. Sections 5 and 6 
include all the results needed for local solubility. For the sake of brevity we do not include 
all the details of the calculations, they are of course availaible upon request. In section 
7, one finds several examples of families where we find the Q-rank, and we also give some 
applications, such as prime values of certain cubic forms. 

The main strategy here is improving on [4], Section 8.4, where this explicit way of 
doing descent is explained for 2-descent. The 3-Selmer group has also been studied in [20], 
precised by [8]. See for example [6, 7, 13] and their references for a more general treatment. 

We would like to thank J. Cremona for his interest and the anonymous referee for his 
advice. 

1.1. The Geometric Setting. We recall a few facts about descent on elliptic curves. Let 
E/k an elliptic curve over a number field k and let n > 2 be an integer. First, using Galois 
cohomology, we have the short exact sequences: 



^E{k)/nE{k) ^H\k,E[n]) ^ H\k, E)[n] -0 




H E{k,)/nE{k,) W H\k,, E[n]) ^ J] H\k,, E) [n] 

V V V 
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We recall the definition of the n-Selmer group: 

Se\^''\k,E) := Ker (^ip : H\k,E[n]) — >Y[H\ky,E)[ 

V 

We also recall the definition of the Tate-Shafarevich group: 

m.{k,E) := Ker i^H\k,E) — >Y[H\k^,E) 

V 

This leads to the following short exact sequence: 

— > E{k)/nE{k) — > Sel^°n^>^) — ' m{k,E)[n] 
where one can show that every term is a finite group, so that 

^Qp\k,E) = E{k)/nE{k) m{k,E)[n] 



n 



0, 



which gives 



n 



Tk{E/k) 





Sel(°)(^>^) 




E{k)torJriE{k)tors 




m{k,E)[n] 



Thus, to get the exact value of the rank Tk{E/k), we must compute the n-Selmer group 
and the n-torsion part of the Tate-Shafarevich group. 

Recall that a twist of an object X defined over k is an object Y defined over k that is 
isomorphic to X over k. 

Since Sel(°^(A;, £;) C H\k,E[n]), if we find a geometric object X such that Autfc(X) ^ 
E[n], we can interpret the elements of the n-Selmer group as twists of the object X. This 
idea gives rise to different interpretations of the elements of the n-Selmer group, as is clearly 
explained in [6, 7]. In the present paper we are going to describe explicitly the geometrical 
interpretation of those elements that we now recall. First, if O denotes the identity element 
of E, the complete linear system given by \n.0\ induces a morphism: E — > P"~^. 

Definition 1.1. A diagram [C — > S] is a morphism from a torsor C under E to a 
variety S . We will say that two diagrams [Ci — > Si\ and [C2 — ^ >S'2] are isomorphic if 
the following diagram is commutative: 



Co — 
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We nnll define a Brauer-Severi diagram [C — > S] to be a twist of the diagram X — 
[E — > P""^]. In particular S is a twist of¥^~^, called a Brauer-Severi variety. 

Following [7], we interpret an element of the n-Selmer group of £^ as a Brauer-Severi 
diagram [C — > S] such that the curve C has points everywhere locally, hence one can 
take S = P"-\ 
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We now specialize to the case n = 3. In this particular case, the Brauer-Severi diagrams 
we are looking for are of the type [C — > P^] , the curve C being a plane cubic with points 
everywhere locally, given with an action of £'[3] on it by linear automorphisms. 

1.2. The Arithmetic Setting. For the proofs of all the results given in this section, we 
refer to [4], Section 8.4, although there are other pointers in the literature. The 3-Selmer 
group in this particular case has also been studied in [20], precised by [8]. 

Let E be an elliptic curve defined over Q and having a rational 3-torsion subgroup that 
we denote {0,T, —T}. Let us stress here that the point T does not need to be rational 
itself. It is easy to see that E can be given by an affine equation of the type 

y"^ ^x^ + D{ax + hf 

with a, 6, and D in Q, and the discriminant of E is equal to 166^1^^ (4Z}a'^ — 276), so 
we must have h and D nonzero and ADa^ — 27b ^ 0. The 3-torsion point T is equal to 
(0, 6-/D), so is rational if and only if e Q*^. 

Lemma 1.2. There exists a unique equation of E of the form = + D{ax + by , where 
a, b, and D are in 'Z, D is a fundamental discriminant (including 1), b > 0, and if we 
write b — bib^ with bi cubefree then (a, 63) = 1. 

Proof. We can write uniquely D = Dof^, where Dq is a fundamental discriminant and 
/ e Q*, so our initial equation can be written y^ = x^ + DQ{a'x + b'Y with a' — fa and 
b' — fb. Changing {x,y) into {x/u^^y/u^) changes {a\b') into {ua',v?b')^ so it is clear 
that we may assume that a and b are in Z, and if 6 = 6163 and g = (63,0), changing 
{x,y) into {xg^,yg^) changes (a, 6) into {a/g,b/g^), hence (0,63) into {a/g,bs/ g), so insures 
that (0,63) — 1. Finally, changing (a, 6) into (—a, —6) insures that 6 > 0. Uniqueness is 
immediate and left to the reader. □ 

From now on, we will always assume that the equation of our curve is given satisfying 
the conditions of the above lemma (although we will mainly use the fact that D is a 
fundamental discriminant), and we will denote by K the field K = Q(\/D) of discriminant 
D, which will be equal to Q if D = 1 and to a quadratic field otherwise. 

Given such a curve E, our aim is to give an estimate for the rank of E, and if possible 
the rank itself, using 3-descent. We first recall the definition and main properties of the 
3-descent maps. 

Definition 1.3. Let E be an elliptic curve defined over Q, choose an affine model given by 
an equation y^ = x^ + D(ax + by with D a fundamental discriminant, and let T = (0, b\fD) 
be a 3-torsion point. 

(1) The 3-descent map a is a map from E[Q) to the subgroup G3 of classes of elements 
ofK*/K*^ whose norm is a cube (or G3 = Q7Q*^ if D ^ 1) defined by a{0) = 1, 
q;((0, b)) — 1/(26) when D — 1, and in general by a{{x, y)) — y — {ax + b)y/D. 
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(2) The curve E is defined by a similar equation y"^ = x'^ + D{ax + by , where D = ~3D, 
a = a, and b = {27b — Aa^D)/'^, and the corresponding 3-descent map is denoted a. 

Moreover we have f = (0, 6v^) = (0, (276 - 4:a^D)^/^3D/9). 

(3) The map from E to E is defined by 

'x^ + 4:D{{a^/3)x^ + abx + 6^) y{x^ - ADb{ax + 26)) 



HP) 



x'^ ' x^ 



for P O and P ^ ±T, and (t){P) = O if P = O or P = ±T, and the map (p from 
E to E is defined in the same way, replacing the coefficients of E by those of E, 
except that the x-coordinate must be divided by 9 and the y-coordinate by 27. 

Proposition 1.4. (1) and (f) are dual 3-isogenies (in particular group homomor- 
phisms) between E and E, so that o and o are the multiplication-by-3 maps 
on E and E respectively. The kernel of (f) (over Q) is {0,±T}, and that of (f) is 

{d,±f}. 

(2) The map a is a group homomorphism from E{Q) to G3, and Ker(Q;) = lm(0). 

2. 3-Descent with a Rational 3-Isogeny 

We now explain how the use of the 3-descent maps a and a gives a precise estimate on 
the rank of E (and of the isogenous curve E, which has the same rank). Before proving 
the main result (Proposition 2.2 below), we need the following precise description of the 
rational 3-torsion points of an elliptic curve (evidently, if an elliptic curve does not have 
a rational 3-torsion subgroup, in other words if it does not have an equation of the form 
y'^ — + D{ax + 6)^, the only rational 3-torsion point is O). 

Lemma 2.1. Let y^ = x^ + D{ax + b)^ be the equation of an elliptic curve E with ratio- 
nal 3-torsion subgroup, and assume as usual that this equation is written so that D is a 
fundamental discriminant. The rational 3-torsion points of E are the following: 

(1) IfD = 1, the points O and (0,±6). 

(2) If D — —3 and 2(96 -|-4a^) = t^ is the cube of a rational number t ^ 0, the point O 

3 f 16 \ 4a^ 
and the points P such that x{P) = — - -|- — f4a6-|- —a^) H — —■ 

(3) Otherwise, only the point O. 

Proof. Let Q — {x,y) be a 3-torsion point. Then we have x([2]Q) = x{—Q) = x{Q), 
which gives, using the formulas on p. 59 of [19] for the duplication law on the elliptic curve 
E: 

x{3x^ + ADa^x"^ + 12Dabx + 12r>6^) = 0. 

LetP(a;) = 3x=^+4DaV + 12Da6x+12D6^ Note that Disc(P) = -Ad>D'^{-21b+ADa^fb'^. 
So either we have x = 0, then = D6^, or we have P{x) — and we obtain after an easy 
calculation: 

y2 = -|(ax + 36)^ 
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It is then straightforward to find the rational solutions, keeping in mind that D is a 
fundamental discriminant. □ 

We can now give the following the exact analogue of Proposition 8.2.8 of [4], whose proof 
we follow verbatim. 

Proposition 2.2. Let E be the elliptic curve ip' = + D{ax + bp and E the 3-isogenous 
curve with equation ip = — 3D{ax + (276 — 4a^/})/9)^ as above, and let a and a be the 
corresponding 3-descent maps. Then 

|Im(a)||Im(S)| =3''+'' , 

where r is the rank of E ( and of E ), and 5—1 if D — 1 or D — —3 and S — otherwise. 

Proof. If Et denotes the torsion subgroup of E we have 

E{Q)/3E{Q) ~ Et{Q)/3Et{Q) © {Z/3Zy . 

Set G — Et{Q). We know that if G is a finite Abelian group then G/3G is noncanonically 
isomorphic to GfS], in other words to the group of 3-torsion points of G. Thus by Lemma 
2.1, Et{Q)/3Et{Q) is trivial unless either D ^ I, ov D ^ -3 and 2(96 + 4a^) is a cube. 
Write So^n for the usual Kronecker (5-symbol, and 7(0, 6) for the condition that 2(96 + 4a^) 
is a cube. With this notation we can thus write 

\E{Q)/3E{Q) \ ^y+^D,i+SD,-zi{a,b) _ 

On the other hand, let us consider our 3-isogenies and 0. Since 0o0 is the multiplication- 
by-3 map, we evidently have 

|E(Q)/3E(Q)| = [Em : 0(^(Q))][0(E(Q)) : ?(0(i?(Q)))] . 

Now for any group homomorphism <j) and subgroup B of finite index in an abelian group 
A we evidently have 

0(A) A A/B A/B 



(f){B) 5 + Ker(0) {B + Ker{(j)))/B Ker(0)/(Ker(0) n 5) 

Thus 

[Ker(0) : Ker(0) n B] 

We are going to use this formula with A = E{Q) and B = (f){E{Q)). We know that Ker(0) 
(over Q) has three elements O and ±T, and T G 0(i?(Q)) if and only if D = —3, so (once 
again over Q), Ker(0) = {O, ±T} if D = —3, and is trivial otherwise. Thus, if D —3 we 
have [Ker(0) : Ker(0) H B] — 1. Assume now that D — —3, so that the equation of E is 
y2 ^ x^-3{ax + by, and that of E can be taken to be = + (3aa: + (96 + 4a^))^. Then 
[Ker(0) : Ker(0) n S] = 1 if T e (f){E{Q)), and is equal to 3 otherwise. We know (see for 
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instance [4], Proposition 8.4.4) that T e 4>{E{Q)) if and only if 2(96 + 4a^) is a cube, in 
other words with the notation introduced above, if and only if 7(0,6) = 1. Thus, 

l?(^(Q)).?W^(Q)))l^Sg^«l. 

Putting everything together we obtain 

y+5n.i+5n,-s^{a,b) ^ |^(Q)/3^(Q)| = [^(Q) ; 0(E(Q))] [0(E(Q)) : 0(0(E(Q)))] 

= [E{Q) : 0(E(Q))][^(Q) : 0(E(Q))]3^°.-3(^(«'^)-i) . 

On the other hand the 3-descent map a on ^(Q) has kernel 0(^(Q)), so [E{Q) : 0(^(Q))] = 
|Im(Q;)|, and similarly [£^(Q) : 0(-E(Q))] = |Im(a)|, so finally we obtain 

|Im(a;)||Im(S)| = 3"+^°-i+^°--3 , 

proving the proposition. □ 

It follows from this proposition that to compute the rank it is sufficient to compute the 
cardinality of Im(Q;) and of Im(a), which we do separately. As in the case of 2-descent, we 
cannot give an algorithm for this, since there is an obstruction embodied in the 3-part of 
the Tate-Shafarevich group of E, but the method works in many cases. The goal of the 
next sections is thus to compute |Im(Q;)|. 

3. The Case D=1 

We first treat the case D = 1. We choose the equation of our elliptic curve as y'^ = 
+ {ax + 6)^ with a and b as in Lemma 1.2, and we recall that the fundamental 3- 
descent map a from E{Q) to Q7Q*^ is defined by a{0) = 1, a((0,6)) = 1/(26), and 
a{{x, y)) — y — {ax + b) for all other points of E{Q). 

Note: To avoid unnecessary wording, when we speak of a solution to a homogeneous 
equation we always mean a nontrivial solution, where the variables are not all equal to 0. 
Similarly, when we speak of a solution to a homogeneous congruence modulo for some 
prime p, we always mean a solution where all the variables are p-integral, and at least one 
of them having p-adic valuation equal to 0, typically vcnji{vp{X),Vp{Y),Vp{Z)) ~ 0. 

Theorem 3.1. Keep the above notation. 

(1) An element u G Q*/Q*^ belongs to the image of a if and only if for some (or any) 
representative G Q* the homogeneous cubic equation 

uX^ + (l/ii)y^ + 2bZ^ - 2aXYZ = 

has an integer (or rational) solution. 

(2) More precisely, for u = 1 it has the solution {X, Y, Z) = (1, —1, 0), for u = 1/(26) it 
has the solution {X, Y, Z) = (0, 1,-1), and if y— {ax + 6) = uz^ for some z E Q* it 
has the solution {X, Y, Z) = (z^, —x, z) . Conversely, if {X, Y, Z) is a solution of the 
cubic with Z then {x,y) = {-XY/Z'^, {uX^ - {l/u)Y^)/{2Z^)) is a preimage 
ofu in E{Q), and z = X/Z. 
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(3) // the above cubic has a rational solution and if u is the unique positive integer 
cubefree representative ofu, then U1U2 \ (26), where u — u\u2 with the Ui squarefree 
and coprime, and the solubility of the cubic is equivalent to that of 

UiX^ + U2Y^ + {2b/{uiU2))Z^ - 2aXYZ = . 

Proof. (1) and (2). The cases u = 1 and u = 1/(26) (corresponding to the points O and 
T = (0, b) respectively) being clear, we assume that we are not in these cases. Then by 
definition if m belongs to the image of a there exists {x,y) G E{Q) and z & Q* such that 
uz^ = y — {ax + b), and if we set X = z^, Y = —x, and Z = z then 

uX^ + {l/u)Y^ + 2bZ^ - 2aXYZ = ^{u'^z^ + 2uz^{ax + b)- x^) 

= -{{uz^ + ax + bf -x^ - {ax + bf) 
u 

= l{y^-{x^ + {ax + bf))^Q, 

u 

as claimed. Note that since 2; G Q* we have Z 7^ 0. Conversely, let (X, F, Z) be a solution 
to our cubic with Z 0. If we set x = -XYjZ'^ and y = {uX'^ - (l/it)y=^)/(2Z3), we have 
x^ + {ax + 6)^ = {—X'^Y'^ + Z'^ibZ'^ — aXYY)/Z^^ and since by the cubic equation we have 
-2Z{bZ'^ - aXY) = uX^ + {l/u)Y^, it follows that 

+ {ax + bf = ((rf + (1/«)F')' - AX^Y^)/{AZ^) 

= {uX' - {l/u)Y')/{AZ') = y^ , 

so (x, y) G £'(Q). Furthermore, 

a{{x,y)) ^y-{ax + b) ^ {uX^ - {l/u)Y^)/{2Z^) - {bZ^ - aXY)/Z^ 
= {l/{2Z^)){uX^ - {l/u)Y^ - 2Z{bZ'' - aXY)) 
^{l/{2Z')){2uX')^u{X/Zf, 

so is equal to u up to cubes, hence {x, y) is indeed a preimage of u, as claimed. 

For (3) , let u be the (unique) positive integer cubefree representative of u, and write 
u — v,iU2 with the Ui squarefree and coprime. Replacing Y by U1U2Y in the cubic equation 
we obtain the equivalent equation 

ulu2X^ + uiulY^ + 2bZ^ - 2auiU2XYZ = . 

It is clear that this homogenous cubic has a rational solution if and only if it has an integer 
solution, and we may in addition assume that gcd{X,Y, Z) = 1. Assume by contradiction 
that U1U2 f 26. Since U1U2 is squarefree, this means that there exists a prime p such that 
p I U1U2 and p f 26. Since exchanging X and Y in the above equation is equivalent to the 
exchange of ui and U2, we may assume that p \ ui, hence p \ U2- Since p divides the first, 
second and fourth term of the equation it divides the third, and since p \ 26, we deduce 
that p I Z. Thus p"^ divides the first, third and fourth term, so it divides the second, and 
since Ui is squarefree and p \ U2 we deduce that p \Y . Thus, p^ divides the second, third, 
and fourth term, so it divides the first, and again since ui is squarefree and p f U2, we 
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deduce that p \ X , contradicting the assumption gcd(X, Y, Z) = 1. We can thus divide by 
U1U2 to obtain the final equation given in (3). □ 

Geometric Interpretation: 

The plane cubic given in (1) of Theorem 3.1 is the equation of a twist C of the elliptic 
curve E. We can recover a linear action by linear automorphisms by doing the following: 
we pick s e Q* and consider the action: 

(X -.Y-.Z) — >(sX : (l/s)Y : Z). 

This action gives a curve isomorphic to C with u replaced by us^. This is what was 
predicted in the geometrical interpretation of [6, 7] recalled in the introduction. 



4. The Case Dy^l 

We now assume specifically that D 1, so that K — Q{\/D) is a genuine quadratic 
field. Note that to use 3-descent with a rational 3-torsion subgroup, we must compute the 
image of the 3-descent map both for the curve E, and for a 3-isogenous curve E, whose 
D is such that D = —3D. Thus, we always need to consider curves with D 1. We will 
denote by r the nontrivial element of the Galois group Gal(ii'/Q), so that t{\/D) = —Vd, 
and by N = ^k/q the norm from K to Q, both for elements and for ideals. If u & K* we 
denote by [u] the class oi u in K* / K*^ . 

4.1. Description of the Image of a. The equation of our curve is — -\- D{ax-\-hY , 
and the 3-descent map is a map a from £^(Q) to the subgroup G3 of K*/K*^ of classes 
[u] of elements u such that ut{u) = Na7q('u) G Q*^, defined by a{0) = 1 and a{{x,y)) — 
y-{ax + h)^/D for all other points of E{Q) (note that T = (0, h\/D) ^ E{Q)). The image 
of a can be described as follows. 

Theorem 4.1. Keep the above notation. 

(1) An element [u] E C K* /K*"^ belongs to the image of a if and only if for some (or 
any) representative u G K* of the forin u = f^r(t') the homogeneous cubic equation 

2v2X^ + 2DviY^ + „ + dviX'^Y + 6v2DXY^ + 2a(X^Z - DY^Z) = 



has an integer (or a rational) solution, where we write v = Vi + V2V D. 
(2) More precisely, for u — 1 it has the solution (X, Y, Z) — (1, 0, 0), and if y — (ax + 
— v'^t{v)z^ for some 2; G Q* it has the solution (X, Y, Z) — [zi, Z2, 1), where 
z — zi + Z2VD. Conversely, if {X, Y, Z) is a solution of the cubic with Z ^ then 



^ X^-DY' Mv{x + yVDf) 

{x,y) = I vt{v) — ,vt{v) — 

is a preimage of u in E(Q) with z — {X + Yy/D)/Z, where by abuse of notation 
we write ^{a) — {a + T{a))/2. 
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Proof. If we set a' = a\fD and h' = bVD, and ignore for the moment all rationality 
questions, the equation of our curve is y'^ — + {a'x + h'Y , so if |/ — {a'x + h') = y — 
(ax + b)y/D — uz^ then (X, Y, Z) — [z^, —x, z) is a solution to the modified cubic uX^ + 
ll/u)Y^ + 2hy/DZ^ - 2a^XYZ = 0, and conversely if {X,Y, Z) is such a solution then 
(x, I/) = {— XY / Z'^ , {uX^ — (l/?i)F^)/(2Z'^)) is a point on the curve. So formally there 
is no problem. We now must add the condition that not only (x, G E{K), but that 
{x,y)eE{Q). 

We first choose suitable representatives u. Let for the moment u be any representative 
of [v], so that ut{u) = fi^ for some ^ E Q. This implies that {u^ / ii'^)t{u^ / jj?) = 1, hence 
by a weak form of Hilbert's theorem 90, we have = fj,^v/T{v) for some v E K, hence 
u = {u/ ij,)^t{v)/v = {u/{ij,v))^v^t{v). Since u is defined up to cubes, we may therefore 
assume that u — v'^t{v) for some v e K*. Thus ut{u) — jx^ with fx — vt{v). Multiplying 
V by a suitable rational number we can assume that v G Ijk- 

Now the condition a; G Q means that XY/Z"^ G Q, so that Y/Z = \t{X/Z) for some 
A G Q*. The condition y G Q is thus that ua^ - {\^/u)T{aY G Q, where a = X/Z. 
Replacing u by v'^t{v) and dividing by the rational number vt{v) gives the condition 
va^ - {X^/{v^T{vf))T{af G Q. Setting (5 = va^ and r = {X/{vT{v))f G Q*, this gives the 
condition (3 - rr(P) G Q, so if /3 = s + t\/D, we have (3 - rT((3) = s + t\/D - r{s - t\fD), 
hence the condition is t(r + 1) = 0, in other words either r = —1, so A = — /i, or t = 0. 

If t = then (5 = va^ G Q, hence u = v'^t{v) = {l3/{a^r{a))y\ so [u] is trivial. It follows 
that the case t — corresponds to the unit element of G3, which we now exclude. 

Thus we may assume that A = —/i. The cubic equation is thus ua"^ — T{ua^) + 
2a\fDiiaT{a)+2h\/D = 0, and since jj, — vt{v) this gives {va^—T{va^))/{2\/D)+aaT{a) + 
b/{vT{v)) = 0. Recall that v is given, so write v — Vi + V2VD and a — Xi + X2\/D. The 
above equation is thus 

2v2xl + 2Dvixl + 6vixlx2 + 6v2Dxixl + 2a{xl - Dxl) + 2b /{vl - Dvl) = , 

so setting Xi — X/Z , X2 — Y/Z with X, y, Z in Z we obtain finally 

2v2X^ + 2DviY^ + {2h/{vl - Dvl))Z^ + GviX^F + Qv2DXY'^ + 2a{X'^Z - DY^Z) = . 

The formulas for {X, Y, Z) knowing x and y and vice versa are immediately obtained by 
replacing the corresponding quantities in the formula given for the case D — 1. D 

Remarks. 

(1) The cubic equation in (1) of Theorem 4.1 can be written 

(v(X + Y^/D)^ -t(v){X -Y^/D)^)/^/D 
+ 2aZ{X + Y^/D){X - Y\/D) + 2b/{vT{v))Z^ = . 

(2) By the theorem, the solubility of the equation depends only on the class [u] of u, 
hence we can change v into v^^ for any 7 G K*, or v into vr for any r G Q* without 
changing the solubility of the equation. This is of course clear directly. 
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(3) Since the image lm{a) of a is a group, [u] e lm{a) if and only if [l/u] G Im(a), so the 
solubility for v is equivalent to that for v'^. Furthermore since t{u) = M^^(i;r(i;))'\ 
[t{u)] e Im(Q;), so the solubility for v is equivalent to that for t{v). 

(4) Geometric Interpretation: The plane cubic given in (1) of Theorem 4.1 is the equa- 
tion of a twist C of the elliptic curve E. We get a linear action by linear automor- 
phisms by doing the following: we pick s G Q* and consider the action: 

{X -.Y : Z) — > {sX -.sY : {l/s'^)Z). 

This action gives a curve isomorphic to C with u replaced by us^. 

The reader will notice that we have not given an analogous result to (3) of Theorem 3.1, 
which is essential since it is necessary to check only a finite number of elements of G3. We 
do this in the next subsection. 

4.2. Reduction of Elements of G3. We begin by the following lemma. 

Lemma 4.2. Assume that x and y are rational numbers such thai y'^ = + D{ax + 6)^, 
and write x = m/d,^ and y = n/d^ with gcd(m, d) = gcd(n, d) = 1 and d > 0. Finally, set 
f = gcd(n — d{am + bd^)\/D, n + d{am + hd'^)\fD), where the GCD is understood in the 
sense of ideals. 

(1) There exist integers f and g such that g is a squarefree integer dividing D, and 
f — f9^> where V is the unique ideal such that — gl^K (when D — 1 we have of 
course g = 1 and = Zj. 

(2) // we write f = fiq^ with fi cubefree then gfiq^ \ 2b, and in particular, g \ 
gcd{D,2b). 

(3) If p \ fi then p is split in K/Q, and in particular g and fi are coprime. 

Proof. The case D — 1, which we do not need, is left to the reader, so assume that 
D 7^ 1, so that X is a quadratic field. We can write uniquely f = FD, where F G Z and 
d is an integral ideal of K which is primitive, in other words which is not divisible by any 
element of Z other than ±1. Evidently ^ cannot be divisible by inert primes; since f is 
the GCD of two conjugate elements it is stable by conjugation, hence D cannot be divisible 
by an ideal p above a split prime p, otherwise it would also be divisible by t(p), hence 
by P = Pt{P)- Finally since = pliK for a ramified prime p, () cannot be divisible by 
a ramified prime to a power higher than the first, so O is equal to a product of distinct 
ramified primes. Thus we have c) = UpeSo ^ '^0 of ramified primes p, and if 

g — ripeSo^' ^here p is the prime number below p, we thus have f = -PTlpigP g \ D, 
hence also = F^g. 

Let us now use our equation. Replacing x and y by m/d^ and n/d^ we obtain the 
equation 

(n - d{am + hd'^)\/D){n + d{am + hd'^)\/D) = - Dd'^{am + hd'^f = . 

It follows that F'^g \ m^. Let p \ g and p be the prime ideal above p. Since the two factors 
are conjugate, if > 1 is the p-adic valuation of the first factor, it is also that of the second. 
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This implies both that v = fp(f) and that 3vp{m) = 2fp(f), in other words 

3vp{m) = vpif) =v = v,{f)/2 = v,{F^g)/2 = v,{F'g) = 1 + 2vp{F) 

since p \ g and g is squarefree. We deduce that Vp{F) = 1 (mod 3), and in particular 
that Vp{F) > 1, so p I F, proving that g \ F. Thus, we will set F = fg for some / G Z. 
The same reasoning shows that if p is any inert or ramified prime (dividing f or not) then 
3vp{m) = Vp(f), so 3 I Vp{f). 

Since pg^ \ rn? we have g \ m and p \ {m/gY. Write / = fiq^ with /i cubefree. 
For all primes p we have Vp{m/g) > Vp{q) + \2vp{fi)/3~\. Since < fp(/i) < 2 we have 
[2fp(/i)/3] = Vp{fi), so /ig^ I m/g. Note that f = pg^ = pg^q^, so since for any inert or 
ramified prime we have 3 | t'p(f), for such a prime we have Vp(/i) = 0, so /i is only divisible 
by split primes. In particular it is coprime to D, hence to g. 

Since {n — d{am + b<f)\fD) / {f g) is an algebraic integer and D is a fundamental discrim- 
inant, it follows that fg \ 2gcd(n, d{am + hd'^)), hence fg = gfiq^ \ 2gcd(n, d{am + bd"^)). 
Since 2bd^ — 2d{am + bd^) — 2adm and gfiq^ \ m we deduce that 2bd^ = (mod gfi(f). 
Since d and n are coprime there exist integers u and v such that un + vd^ — 1, hence 
2b — 2bvd^ + 2bun, and since gfiq^ \ 2bd^ and gfiq^ | 2n, we have gfiq^ \ 2b, as claimed. 

n 

Corollary 4.3. Keep the above notation, and let [u] e Im(Q;) C G3. There exists an 
integral ideal \J of K such that uZk = 0^r(o)q^ for some ideal q of K, and which is such 
that gcd(o,r(o)) = 1 and fi — Nx/q(d) is a cubefree divisor of 2b divisible only by primes 
which are split in K/Q. 

Proof. The above lemma states that if we set 

f = gcd (n - d{am + bd'^)VD, n + d{am + bd^)VD^ 

there exist integers /i, g, and q in Z and an ideal d E K such that f = fiq^g'O with /i 
cubefree divisible only by split primes, g \ gcd(£),26), gl^K — 5^, and gf\q^ \ 2b. Thus 
f = fi(qdf. Set a_ = (n - d(am + bd^)\/D)/f and a+ = (n + d{am + bd'^)\/D)/f, so that 
gcd(a_,a+) = 1 and our equation implies a_o+ = m^/f (since we work with ideals, we 
lose some unit information here). Since /i is cubefree and divisible only by split primes, 
it is also cubefree as an ideal, and the condition f \ w? implies as above that /i(gc))^ | m, 
hence gficf \ m (this time in Z), so the equation now reads 

a_a+ = fi{m/{gf,q^)fZK . 

Since f is stable by conjugation, it is clear that a+ = T(a_) so this equation gives the norm 
of a±. In any case, write a_ = f-l^, a+ = f+Cl+ with f± cubefree, so that in particular 
gcd(/_, /+) = 1, and also f+ = 'r(f_) and q+ = T(q_). At the level of ideals our equation 
is thus f-f+(q-q+)^ = fiij^'^/ {.9 fi(f')Y'^K- As we already mentioned /i is also cubefree 
in K, and since f_ and f_|_ are coprime and cubefree, by uniqueness of the decomposition 
as the product of a cubefree ideal with a cube it follows that q_q+ = m/ {gfiq^)'LK and 
f_f+ = fi^K. In particular, f- | /i. 
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Now recall that the 3-descent map a is defined on an affine point as the class modulo 
cubes oiy — {ax + b)y/D = {n — d{am + hcP)^/D) / . Thus 

«((a;,|/))Zx = fa_ = /i(g0)3f_q3_ = /if-(gOq_)^ = DV(D)q? 

for some ideal qi, with D = f_, as claimed. □ 

Remark. It is clear that the condition gcd(t), r(t))) = 1 implies that d is primitive, 

in other words that the only elements of Z which divide it are ±1. Furthermore, since 
t)V(D) = Mq-^ the ideal class of D in Cl{K) belongs in fact to {Cl{K) / Cl{Kf)[T + 2], 
where for any group G and map (p from G to G, G[(p\ denotes the elements of G killed by 
0, in other words the kernel of 0. 

Now recall the definition of a S-virtual unit (or virtual cube) and 3-Selmer group: an 
element u G K* is a virtual cube if uZ^ = q^ is the cube of an ideal. The group of virtual 
cubes modulo cubes of elements is called the 3-Selmer group of K and denoted Ss{K). 
It is clear that S3{K) C G3, and it is well-known and easy that we have a natural exact 
sequence 

1 U{K)/U{Kf Ss{K) Cl{K)[3] 1 . 

Let as usual I{K) denote the group of (nonzero) fractional ideals of K, and let Gg be the 
subgroup of I{K)/I{K)^ of classes of ideals whose norm is a cube. 

Lemma 4.4. We have a natural exact sequence 

1 — > SsiK) — >G3 — >Gi — > Cl{K)/Cl{Kf — > 1 . 

Proof. Consider first the map i from G3 to G\ which sends a class [ix] to the class of 
vIjk- It is clear that it does send G3 to G\. If [u] is sent to the unit element of G\ this 
means that uIjk = q^ for some ideal q, in other words that [n] G 6*3 (fC), giving the kernel. 
Consider now the map sending the class of an ideal modulo cubes to its ideal class. It 
defines a map tt from G\ to Cl{K) / CI{KY . If some ideal a is sent to the unit element of 
Cl{K) /Cl[K)^ this means that there exist an ideal q and an element 7 G K* such that 
a = 7q^. Thus, the class of a modulo cubes of ideals is equal to that of 7^^. Furthermore, 
the norm of a is a cube, so that of 7 also (since —1 is a cube), hence 7 does come from 
G3, proving exactness at G\. Finally, let us show that the map tt is surjective. Let a be 
an ideal, representative of an element oi Cl{K)/Cl{K)^. Then since Nx/q(ci) — a E Q*, 
aNi^/Q(a) is in the same ideal class as a, and its norm is evidently equal to (Nx/(Q(a))''^, 
so the class of a is the image of the class of aN;^/Q(a) in G3, proving surjectivity and the 
lemma. □ 

Corollary 4.5. If we denote by a'^ — i o a the 3-descent map from E to G\ we have 

\lm{a)\ = \lm{a%S^{K) n Im(Q;)| . 
In particular, if D < 0, D ^ —3, and 3 f h{K) we have |Im(Q;)| = |Im(Q;*)|. 

Proof. By the above lemma the map i induces an injection from G^/ S^i^K) to G\. Thus, 
for any subgroup H of G3 the map i induces a bijection from H/{Sz{K) fl H) to i{II). 
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Applying this to the finite subgroup lm{a) gives the formula of the corollary, and the 
special case corresponds to 5*3 (A') = 1. □ 

Note that if 7 is a 3-virtual unit then N(7) = 7t(7) is a cube. More generally, if 7 is 
such that N(7) = is a cube we can write 7 = v'^T{v)q^ with v = j and q = 1/n. Thus, 
using Corollaries 4.3 and 4.5 and Theorem 4.1 we can compute |Im(a)|. Xote however 
that it will be completely algorithmic and easy to prove everywhere local solubility of our 
homogeneous cubics, so that we will compute the 3-Selmer group of E. On the other hand, 
for global solubility, either we find a solution with a reasonable search bound, or we are led 
to believe that no such solution exists, coming from a nontrivial element of the 3-part of 
the Tate-Shafarevich group. Thus, it is reasonable to give an algorithm which computes 
both the rank of the 3-Selmer group and a lower bound for the rank of the curve, so which 
gives the exact rank when they coincide. 

(1) For each class [7] G S3{K) choose a representative 7 e K*, and check that the 
cubic of Theorem 4.1 has a solution foi v — ^ (more on this later), let T5 be the 
group of [7] for which it is everywhere locally soluble (ELS), and Tq the subgroup 
generated by the elements for which we find that it has a global solution. Thus 
Tq d T <Z Ts G 5*3 (i^T), where T = 6*3 (i^T) nIm(Q;). This will allow us to compute T 
exactly if Ts — To, and otherwise if the search bound is sufficiently large, we suspect 
(but cannot prove without further work) that in fact T = Tq and that the elements 
of Ts/Tg correspond to nontrivial elements of the 3-part of the Tate-Shafarevich 
group. Note that using the fact that Tq and T5 are groups, it is not necessary to 
test all classes [7], but in fact using the fact that they are even Fa-vector spaces it 
is sufficient to work on bases of these spaces and use linear algebra. Finally, choose 
a set Rs of representatives of S3{K)/Ts and a set Rq of representatives of Ts/Tg- 

(2) Let / be the largest positive integer cubefree divisor of 2h divisible only by split 
primes, write / = ni<i<s^'r with 1 < Vi < 2. For each p,, let pj be one of the 
two prime ideals above pj, fixed once and for all. Find all ideals of the form 
t) = ni<i<sPr^' with — 1 < < 1 whose ideal class is a cube (although this seems 
to be 3'^ principal ideal tests, it is easy to reduce to only s such tests using linear 
algebra, but in practice Cl{K) will be small). 

(3) For each ideal D that we have found write = uq^ for some ideal q and some 
element u e K*, where clearly the class [u] of u in G3 is determined uniquely 
modulo multiplication by an element of Ss{K). For the moment, we choose any u 
as above. 

(4) For each [75] e Rs, where Rs is the system of representatives of S^{K)/Ts com- 
puted in (1), and any representative 75 G K* , check whether the cubic of Theorem 
4.1 is everywhere locally soluble (ELS) for v — wjs (more on this later). If for some 
[js] G Rs this is the case, there will be only one, and then D G Sel(Q;*), with evident 
notation, otherwise D ^ Sel(Q;*). In this latter case, we do nothing more, otherwise 
for each [70] G Rq, where Rq is the system of representatives of T^/Tg computed 
in (1), and any representative 70 G K*, check whether the cubic of Theorem 4.1 
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has a global solution up to a reasonable search bound for v = wyslR- If this is the 
case, once again there will be only one, and then D e Im(Q;*), otherwise we suspect 
(but cannot be sure) that ^ lm.{a^). We let Iq be the group generated by the 
for which we are sure, so that Iq is a subgroup of Im(a*), probably equal to it. 
(5) At the end of this process we have computed the Selmer group cardinality | Sel(Q!)| = 
I Sel(Q;*)||T5'|, and groups and Tq probably equal to Im(Q;*) and T respectively, 
but in any case satisfying Tq (Z T (Z Ts and Iq C lm{a^) C Sel(Q;*), and so 
I/gIITgI I |Im(Q;)| I |Sel(a)|, the unknown quantity being |Im(Q;)|. If |/g||Tg| = 
I Scl(a)| then of course these quantities are equal to |Im(Q;)|. Otherwise, we output 
both quantities, and a message saying that we expect |Im(Q;)| to be equal to 
and that the elements of Se\{a) / IoTq correspond to nontrivial elements of the 3- 
part of the Tate-Shafarevich group. 

5. Local Solubility of uiX^ + U2Y'^ + u^Z^ - cXYZ = 

There remains to decide whether or not the cubics of Theorems 3.1 and 4.1 have a 
rational solution. It is unfortunately well-known that there is no algorithm for doing this. 
We thus proceed as follows: we first check whether the cubic is everywhere locally soluble 
(which we will abbreviate to ELS). If not, there are no rational solutions. Otherwise, either 
there is an obstruction in the 3-part of the Tate-Shafarevich group, or there does exist a 
rational solution which we can find using a more or less efficient search. If we do find one, 
we are done, otherwise we give up and can only give bounds on |Im(Q;)|, not its precise 
value. 

Testing ELS is an algorithmic process, but is not completely trivial. In this section we 
give such an algorithm. Since the degree is odd there is no need to look at local solubility 
in R. We treat the following slightly more general problem: decide solubility in Qp of the 
equation 

F{X, Y, Z) = u^X^ + U2Y^ + uzZ^ - cXYZ = . 

For D = 1, in other words, for the cubic of Theorem 3.1, we apply the results that we 
obtain with — 2b/ {U1U2) and c = 2a. 

5.1. Reduction of the Cubic and Bad Primes. By multiplying X, Y, and Z by 
suitable powers of p it is clear that without loss of generality we may assume that Ui, U2, 
U3 and c are p-integral. Dividing by a suitable power of p we assume that 

min{vp{ui),Vp{u2),Vp{u3),Vp{c)) = 0. 

We need further reductions, as follows. 

Lemma 5.1. Assume as above that mm{vp{ui),Vp{u2),Vp{u3),Vp{c)) — 0. 

(1) If mm{vp{ui) , Vp{u2) , Vp{u3)) > the equation is soluble in Qp. 

(2) Assume that Vp{c) > 0, so that mm{vp{ui) , Vp{u2) , Vp{u3)) — 0. The equation is 
equivalent to one where either Vp{c) = or 

max{vp{ui),Vp{u2),Vp{u3)) < 2 . 
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(3) Assume that Vp{c) > and that max{vp{ui),Vp{u2),Vp{u3)) < 2 (which can be 
achieved by (2)), and without loss of generality order the variables so that = 
Vpiui) < Vp(u2) < Vp{u^) < 2, and let v = {vp{u2),Vp{us)). Then 

(a) If V = (1,2) the equation is not soluble in Qp. 

(b) Or the equation is equivalent to one such that either Vp{c) = or Vp{uiU2U3) < 
2 (andmm{vp{ui),Vp{u2),Vp{u3)) = if Vp{c) > 0). 

Thus, given a completely general cubic equation of the form uiX^ + U2Y^ + u^Z^ — 
cXYZ — 0, we use the following procedure, where we distinguish the cases c ^ and 
c = 0. 

Assume first that c 7^ 0. 

(1) Let g = gcd{ui,U2,U3,c), and replace {ui,U2,U3,c) by {ui/g,U2/g,U3/g,c/g), so 
that we may now assume that gcd{ui,U2,us,c) — 1. 

(2) For each prime p | c, do the following. 

(a) By dividing Ui, U2, M3, and c by suitable powers of p as explained in the lemma, 
we reduce to an equation with either Vp{c) = or ma,x{vp{ui) , Vp{u2) , Vp{u3)) < 
2. 

(b) If now Vp{c) = or if itnm{vp{ui),Vp{u2),Vp{u3)) > we do nothing more for 
the prime p. Otherwise, reorder the variables Ui so that = Vp{ui) < Vp{u2) < 
Vpiua) < 2. 

(c) If Vp{u2) — 1 and Vp{u3) = 2, the equation has no solution. 

(d) Otherwise, if necessary by changing {ui,U2,U3,c) into 

{u2/p'^,u-i/p'^,pui,c/p) , 
we may assume that we also have Vp{uiU2Us) < 2. 
Assume now that c — 0. 

(1) Let g — gcd(wi, ti2, Ms), and replace {ui,U2,U3) by {ui/ g,U2/ g,U3/ g), so that we 
may now assume that gcd(Mi, M2, M3) = 1. 

(2) Replace ui, U2, and by their cubefree part, so that max{vp{ui),Vp{u2),Vp{u3)) < 
2. 

(3) For each prime p \ U1U2U3, do the following. 

(a) Reorder the variables Ui so that = Vp{ui) < Vp{u2) < Vp{u3) < 2. 

(b) If Vp{u2) = 1 and Vp{u3) = 2, the equation has no solution. 

(c) Otherwise, if necessary by changing {ui,U2,U3) into 

(M2/p^M3/p^PMl) , 

we may assume that we also have Vp{uiU2U3) < 2. 
This leads to the following definition: 
Definition 5.2. We will say that a cubic equation is p-reduced if 

mm{vp{ui),Vp{u2),Vp{u3)) = 
and if for all primes p dividing c (all primes if c — 0) we have Vp(uiU2U3) < 2. 



16 



Henri COHEN and Fabien PAZUKI 



Thanks to the above lemma, we can therefore always assume that our cubic is p-reduced, 
since if mm{vp{ui) , Vp{u2) , Vp{usj) > the cubic has a p-adic solution. 

Lemma 5.3. Let p be a prime and let UiX^ + U2Y^ + u^Z^ — cXYZ — be a cubic with 
p-integral coefficients, not necessarily p-reduced. If p ^ 3, Vp(ui) — Vp(u2) — Vp(u3) — 0, 
and Vp{27uiU2U2 — c^) — 0, the cubic is soluble in Qp. 

Proof. Let us look at the singular points of the cubic over Fp. First, a point with Z = 
is singular iiuiX^ + U2Y^ = 0, 3uiX^ = 0, and 3u2Y^ = 0, and since we assume p 3 and 
Vp{ui) = 0, this implies X = Y = 0, which is not possible. Thus, any singular point has 
Z 7^ 0, so we may assume that Z — 1. Since p 3, the equation has a singular point in Fp 
for Z = 1 if and only if 3uiX'^ - = 0, 3u2Y^ -cX = 0, and 3^3 - cXY = 0. If there is 
such a singular point we cannot have c = 0, otherwise M3 = 0, in other words Vp{u^) > 1, 
a contradiction. Thus Y = 3uiX'^/c, X = 3u2Y^/c = 21u\u2X* / , hence either X = 0, 
which is not possible since otherwise X — Y — Q hence — 0, or X^ — c" / {27u\u2)^ 
so that 81x3 = cXY — 3uiX^ — c^/{9uiU2), in other words 27uiU2U3 — — 0, which is 
also excluded. Thus the cubic is nonsingular over Fp. Since it is a curve of genus 1 and 
3 — 2\/2 > 0, it follows from the Weil bounds that for every prime p it has a nontrivial 
point in Fp. If p is not in the excluded list this point is necessary nonsingular, and since 
we assume p 7^ 3 we can perform a Hensel lift to Zp as soon as we know that there is a 
solution modulo p, proving the lemma. □ 

5.2. Local Solubility for p \ UiU2Us, p ^ 3. Thanks to Lemma 5.1, we may assume that 
our cubic is p-reduced, and thanks to Lemma 5.3, it is enough to consider the primes p 
such that Vp{uiU2U3) > 0, Vp{27uiU2U3 — c^) > 0, or p = 3. We begin by primes p 7^ 3 
such that Vp{uiU2U3) > 0. For such primes, by symmetry we may assume that Vp{ui) > 0, 
and since the cubic is p-reduced we have mm{vp{u2),Vp{u3)) — 0, so again by symmetry 
we may assume that < Vp{ui) < Vp{u2) < Vp^u^). 

Lemma 5.4. Let p be a prime, assume that our cubic is p-reduced, and assume that p 7^ 3 
and Vp{uiU2U3) > 0, with < Vp{ui) < Vp{u2) < Vp{u3). The cubic is soluble in Qp if and 
only if one of the following conditions is satisfied. 

(1) vp{c) = 0. 

(2) Vp{c) > 0, Vp{ui) = Vp{u2) = 0, and the class of Ui/u2 m.odulo p is a cube in ¥*. 

(3) Vp{c) > 0, Vp{ui) = 0, Vp{u2) = Vp{u^) = 1, and the class of U2/U2 modulo p is a 
cube in F*. 

Remarks. 

(1) Note that since the cubic is p-reduced, the above lemma covers all possible cases 
for which p 7^ 3 and Vp{uiU2U2) > 0: indeed, if Vp{c) > we have necessarily 
Vp{uiU2U3) < 2, SO up to ordering we have either Vp{ui) — Vp{u2) — (and Vp{u3) < 
2), or Vp(ui) = and Vp{u2) = Vp{uz) = 1. 

(2) It follows from the proof that the cubic is also soluble in case (1) when p = 3, in 
other words iivs{uiU2U3) > and v^lc) — 0, but the assumption p 7^ 3 is necessary 
in cases (2) and (3). 
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5.3. Local Solubility for p \ {27uiU2U3 — c"^), p 7^ 3. In this section, we assume that p is 
a prime different from 3 such that p \ {27uiU2U3 — c^). We may also assume that p \ U1U2U3 
since these primes have already been taken care of in the preceding subsection. 

Lemma 5.5. Letp be a prime, assume that our cubic is p-reduced, and assume thatp ^ 3, 
Vp{uiU2U3) = 0, and Vp{27uiU2U3 — c^) > 0. The cubic is soluble in Qp if and only if U2/U1 
is a cube in F*. 

5.4. Local Solubility for p = 3. Finally we consider local solubility at the prime p = 3. 
By the remarks made above, when 'o?Xc) = we have seen that the cubic is locally soluble 
at 3 if V3{uiU2U3) > 0. We may therefore assume either that ^3(0) > 0, or that ^3(0) = 
V3{uiU2U3) = 0. In the latter case the result is immediate: 

Lemma 5.6. If V3{c) = the cubic has a solution in Q3. 

The final case to be treated is the case t'3(c) > 0. In this case, we need a small strength- 
ening of Hensel's lemma, which we give in a slightly more general form that we will need 
below. 

Lemma 5.7. Set Pq = {Xq,Yq, Zq) , and let k>l. Assume that V3{F{Po)) > 2k and that 
mm{v3{F^{PQ)),V3{FY{Po)),V3{F'^{Po))) = k. Assume that all second and third partial 
derivatives of F are divisible by 3 at the point Pq, the condition on the third derivatives 
being required only if k ~ 1. There exists a 3-adic point P — {X, Y, Z) such that F{P) — 
with P = Po (mod 3*^). 

Now for F(P) = uiX^ + U2Y^ + u^Z^ - cXYZ we have for instance F^{P) = 3uiX^ - 
cYZ, and since t'3(c) > all the partial derivatives are divisible by 3 at any point, so to 
apply the lemma it is enough to find a point such that F{Pq) = (mod 3^*^) and : 

mm{vs{F'^iPo)),V3iFi^iPo)),V3{F',iPo))) = k. 

We will mainly use this lemma with A; = 1, but we will need it also with k = 2. 
In fact we need a variation of the above lemma for A; = 2. 

Lemma 5.8. Let Pq = (Xq, Yq, Zq) be such that 

V3{F{Po))>3 and mm{v3{F;,{Po)),V3{Fi.{Po)),V3{F'z{Po))) = 2 , 

and assume that all second, third, and fourth partial derivatives of F are divisible by 3 at 
the point Pq. Assume in addition that for all Pi = Pq (mod 3) such that v^^F^Pi)) > 3 
we also have min(t'3(F^(Pi)), t'3(Fy (Pi)), t'3(F^(Pi))) = 2. There exists a 3-adic point 
P = {X, Y, Z) such that F{P) = with P = Pq (mod 3). 

Of course for our cubics the fourth partial derivatives vanish. 

Recall that a solution (X, Y, Z) of a congruence modulo some power of 3 is always such 
that min{v3{X),V3{Y),V3{Z)) = 0. 

Lemma 5.9. Let p — 3, assume the cubic 3-reduced, and assume that ^3(0) > 0, so that 
Vz{uiU2Uz) < 2. Reorder the variables so that = V3{ui) < V3{u2) < Vz{uz). 
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(1) // Vs{c) > 2 and Vs{uiU2U3) = the cubic has a solution in Q3 if and only if 
Ui = ±Uj (mod 9) for some i ^ j. 

(2) If v-i{c) > 2 and exactly one of the Ui is divisible by 3 (in other words if V2{u2) — 
and ^3(^3) > Oj, the cubic has a solution in Q3 if and only if either ui = ±U2 
(mod 9), or if V2,{u^) = 1. 

(3) // v^iyc) > 2, and two of the Ui are divisible by 3 (in other words if ^3(^2) = 
'^si''^^) — 1 since the cubic is 3-reduced), the cubic has a solution in Q3 if and only 
ifu2/3 = ±^3/3 (mod 9). 

(4) Ifvs{c) = 1 and exactly one of the Ui is divisible by 3 (i.e., v^(u2) = andv^{u^) > 
0), the cubic has a solution in Q3 if and only if either ui = ±U2 (mod 9), or if 
there exist si and S2 m { — 1, 1} such that c = si^i + 521*2 + S1S2U3 (mod 9). 

(5) If v^{c) = 1 and two of the Ui are divisible by 3 (i.e., v^{u2) — ^3(1*3) — the 
cubic has a solution in Q3. 

Note that this lemma does not cover the case where v^{c) = 1 and none of the Ui is 
divisible by 3, or equivalently V3{uiU2Us) = 0, which will be covered by Lemma 5.10 below. 

Lemma 5.10. Let p = 3 and assume that v^ic) > and V3{uiU2U3) = 0. 

(1) If Ui = ±Uj (mod 9) for some i 7^ j , the cubic has a solution in Q3. 

(2) IfUi ^ ±Uj (mod 9) for i ^ j (which implies that U1U2U3 = ±1 (mod 9) ), the cubic 
has a solution in Q3 if and only if there exist suitable signs Si — ±1 and S2 — ±1 
such that c = siUi + S2U2 + siS2Uz (mod 27). 

Remarks. 

(1) We only assume that Vz{c) > and not vz{c) — 1, although the case vz{c) > 2 is 
covered by Lemma 5.9: indeed, it is easy to see case (2) of the above lemma cannot 
occur when v^{c) > 2. 

(2) It follows from the proof that case (1) occurs if and only if there exists a solution 
{X, Y, Z) with Tn.m{vs{X) , V3{Y) , V3{Y)) = but one of the variables divisible by 3. 

(3) In case (2), there is no need to search among the four possibilities for the signs Sj: 
since 3 | c it is easy to see that we must take si = U2U3 (mod 3) and S2 = uiUs 
(mod 3). 

We have thus finished to give the local solubility of the general cubic equation 
F(X, Y, Z) = uiX^ + U2Y^ + u^Z^ - cXYZ = 0, 
hence in particular of the equation 

uiX^ + U2Y^ + (2b/(uiU2))Z^ - 2aXYZ = 

of Theorem 3.1. 

6. Local Solubility : The Case -D 7^ 1 

6.1. Reduction of the Cubic, Bad Primes, and Split Primes. We now consider local 
solubility when D ^ 1. Although we will do the same type of computations as in the case 
D — 1, there are evidently some added complications. 
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It is essential to begin by a reduction of the cubic equation of Theorem 4.1. Recall that 
in the case D = 1 we could reduce to an equation where u — u\u2 with the Ui squarefree 
and coprime. We have seen in Section 4.2 that the analogous statement ioi D ^ 1 involves 
ideals, so we cannot immediately reproduce what we have done. 

Recall that the cubic equation of Theorem 4.1 can be written as F{X, Y, Z) = 0, where 
if V = Vi + V2 VD we have 

F{X, Y, Z) = 2v2X^ + 2DviY'^ + {2b/ {yl - Dvl))Z^ 

+ GviX^Y + 6v2DXY^ + 2a{X^Z - DY^Z) 
= (v(X + Y^/Df - r(v)(X -Y^/Df)/VD 
+ 2aZ(X + Y^/D){X - Y^/D) + {2b/(vr(v)))Z^ , 

and we will use indilferently both forms. 

Lemma 6.1. If p ^ 3, Vp(vr(v)) = 0, Vp{2b) — 0, and Vp{27b — 4a^D) — the above cubic 
is soluble in Qp. 

Recall that, analogously to ideals, an algebraic integer v is said to be primitive if v/n e 
with n e Z if and only if n = ±1. 

Lemma 6.2. Let [u] e Im(Q;). In the above cubic, we may assume that [u] = [v'^t{v)] 
where v is a primitive algebraic integer such that vr{v) is divisible only by split primes. In 
particular, v and t{v) generate coprime ideals. Furthermore, if D = (mod 4) we may 
also assume that v = vi + V2\fF) with ^2 € Z. 

Note that, contrary to the case D — l,we cannot deduce from this lemma that vt{v) \ 2b. 
It is easy to show using Corollary 4.3 that if 3 f h{K), we may assume that vt{v) \ {2b)^^^\ 
and in particular all prime numbers dividing vt{v) (which are necessarily split) divide 2b, 
but this may not be true if 3 | h{K). 

Since v is now an algebraic integer, we have 2vi G Z and 2v2 G Z, so all the coefficients 
of the equation are integers, except perhaps for 2b/{vT{v)). 

Corollary 6.3. Assume as above that v = Vi + V2\/D is a primitive algebraic integer 
such that vt(v) is divisible only by split primes, and let p be any split prime. There exists 
dp G Qp such that dp — D. The cubic of Theorem 4-i has a solution in Qp if and only if 
the cubic uiX^ + U2Y^ + u^Z^ — cXYZ — does, where ui — vi + V2dp, U2 — vi — V2dp, 
Us = {2b/vT{y))dp, and c = 2adp. 

Since we have given a complete algorithm to determine the solubility in Qp of an equation 
of the type uiX'"' + U2Y^ + ?i3Z^ — cXYZ = 0, this solves the problem for D ^ 1 in the 
case where p is a split prime. Thus we are left with the study of ramified and inert 
primes, so thanks to Lemma 6.2, we may assume that Vp{vT{v)) = 0, so that in particular 
Vp{2b/{vr{v))) > 0. 
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Thus in the sequel we assume that p is a ramified or inert prime, that Vp{vT{v)) = 0, 
and recall that our equation is F{X, Y, Z) — with 

F{X, Y, Z) = {v{X + Y^Df - t{v){X - Y^D f)/^ + mZ^ 

+ 2aZ{X + Y^/D){X - Y^/D) , 

with = 2b/{vT{v)), hence such that Vp{u3) > 0. We begin by inert primes. 

6.2. The Case of Inert Primes. If p is an inert prime, consider the field Kp — Qp{y/D), 
which up to isomorphism is the unique unramified extension of degree 2 of Qp, and whose 
residue field is Fp2 , so that we can also consider the class of a/D in F*2 , and r is defined on 

Fp2 as in characteristic 0. By abuse of notation, if a and (3 are elements of K = Q{\/D) or 
of Kp, we will write a = P (mod p) to mean that the class of a and (3 in the residue field 
is the same. Note that we work in Kp or K for practicality, but that the cubic equation 
has coefficients in Q, and that we also look for solutions in Q. 
Before studying the bad primes, we need an auxiliary lemma. 

Lemma 6.4. Let p ^ 3 be an inert prime. The following conditions are equivalent: 

(1) There exist X and Y such that t(v)/v = ((X + Yy/D)/{X - Y^/D)y (mod p) in 
the above sense. 

(2) The class of t{v)/v is a cube in F*2. 

(3) We have either p = 1 (mod 3), or p = 2 (mod 3) and = 1 (mod p). 

Lemma 6.5. Let D ^ 1, and assume that the elliptic curve is given by an equation 
satisfying the conditions of Lemmas 1.2 and 6.2. Let p be an inert prime number such that 
Vp{2b) > 0, Vp{vT{v)) — and p ^ 3, and if p — 2, assume that Vp{2b) < 2. The cubic of 
Theorem 4-i is locally soluble atp if and only if one of the following conditions is satisfied. 

(1) Vp{2a) = 0. 

(2) Vp{2a) > and the class of t{v)/v modulo p is a cube in F*2. 

We now consider the prime p = 2. assumed to be inert, when V2{2h) > 3. Since the 
equation is 2-reduced, note that either ^2(0) > 0, in which case V2{b) < 2 hence ^2(26) = 3, 
or ^2(0) = 0. Furthermore, we can write v — Vi + V2\/D = {wi + W2\/D)/2 with wi and 
W2 in Z such that Wi = W2 (mod 2), and since v is primitive, either we have Wi = W2 = 1 
(mod 2), or wi and W2 are even with wi ^ W2 (mod 4). 

Lemma 6.6. Let D ^ 1, and assume that the elliptic curve is given by an equation 
satisfying the conditions of Lemmas 1.2 and 6.2, assume that p — 2 is an inert prime, 
in other words that D = 5 (mod 8), assume that V2{2b) > 3, and write Wi — 2vi and 

W2 = 2V2. 

(1) Lf wi = 2 (mod 4) and W2 = (mod 4) or wi = (mod 4) and W2 = 2 (mod 4) 
the cubic has a solution in Q2. 

(2) Lf wi = W2 = 1 (mod 2), the cubic has a solution in Q2 if and only if either 
V2{2b) > 4 orv2{a) > 0. 
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Lemma 6.7. Let D ^ 1, and assume that the elliptic curve is given by an equation 
satisfying the conditions of Lemmas 1.2 and 6.2. Letp be an inert prime number such that 
Vp{2b) = Vp{vT{v)) = 0, Vp{27b — ADa^) > 0, and p 7^ 3. The cubic of Theorem 4-1 «s 
locally soluble at p if and only if t{v)/v is a cube in F*2. 

Recall that since we assume that p is not split we have Vp{vT{v)) — 0. 

Lemma 6.8. Let D ^ 1, assume that the elliptic curve is given by an equation satisfying 
the conditions of Lemmas 1.2 and 6.2, and assume that p = 3 is an inert prime, i.e., that 
D = 2 (mod 3). Set ui = 2v2, U2 = 2viD, and U3 = 2h/{vT{v)). 

(1) If Vs{2a) = the cubic has a solution in Q3. 

(2) Ifv3{2a) > 2 the cubic has a solution in Q3 if and only if either v-i{ui) > 2, V2y{u2) > 
2, Ui = ±Uj (mod 9) for some i ^ j and a suitable sign ±, or if = 2{±ui ± U2) 
(mod 9) for suitable signs ±. 

(3) //t'3(2a) = 1, vz{2h) > 0, and vs{uiU2) > I, the cubic has a solution in Q3 if and 
only if either v^^ui) > 2, f3(-U2) > 2, or f3(2a + 26) = 1. 

(4) If Vz{2a) = 1, f3(26) > 0, and V3{uiU2) = 0, the cubic has a solution in Q3 if and 
only if either Ui = ±^2 (mod 9), orif2a + b = ±Ui (mod 9) for suitable signs 
±. 

Lemma 6.9. Let D ^ 1, assume that the elliptic curve is given by an equation satisfying 
the conditions of Lemmas 1.2 and 6.2, and assume that p = 3 is an inert prime, i.e., that 
D = 2 (mod 3). Set ui = 2v2, U2 = 2viD, and = 2h/ {vt{v)) . Assume that f3(2a) = 1 
and vz(ui) = ^3(^2) = V3{2b) = 0, and set = U3 + 2a, so that we also have ^3(^4) = 0. 

(1) If Ui = ±Uj (mod 9) for some i ^ j with i,j = 1, 2, or 4, the cubic has a solution 
in Q3. 

(2) Otherwise, the cubic has a solution in Q3 if and only if 2a + U4 — Aa + U3 = ±3D 
(mod 27) for a suitable sign ±. 

Similar remarks as those given after Lemma 5.10 apply here. 

This concludes the study of local solubility in the case of inert primes. 

6.3. The Case of Ramified Primes. 

Lemma 6.10. Let D ^ 1, and assume that the elliptic curve is given by an equation 
satisfying the conditions of Lemmas 1.2 and 6.2. If p is a ramified prime such that p ^ 3, 
the cubic is soluble in Qp. 

Lemma 6.11. Let D ^ 1, and assume that the elliptic curve is given by an equation 
satisfying the conditions of Lemmas 1.2 and 6.2. Assume that p — 3 is ramified, in other 
words that 3 \ D, and to simplify notation, set u^ = 2b/ {vt{v)). 

(1) 7/^3(20) = 0, the cubic has a solution if and only if one of the following conditions 
is satisfied: 

(a) t;3(2t;2) > 0. 

(b) ^3(2^2) =^3(20 + 1^3) = 0. 
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(2) If v^{2a) > 2, the cubic has a solution if and only one of the following conditions 
is satisfied: 

(a) D = 3 (mod 9) and Vs{us) = 0. 

(h) D = 3 (mod 9), v^ius) > 0, and ^3(2^2) > 0. 

(c) D = 6 (mod 9) and V3{2v2) > 2. 

(d) D = 6 (mod 9) and Vs{2v2) = ^3(^3) = 1. 

(e) D = 6 (mod 9), V3{2v2) = 0, and U3 = ±2v2 (mod 9). 

(f) U3 = ±2viD (mod 27). 

We will treat the case where vs{2a) — 1 below. 

Lemma 6.12. Keep the notation and assumptions of the preceding lemma, assume now 
that Vs(2a) — 1, and set U4 — Us + 2a. The cubic has a solution if and only one of the 
following conditions is satisfi,ed: 

(a) D = 3 (mod 9) and '03(114) = 0. 

(b) D = 3 (mod 9), v^iu^) > 0, and ^3(2^2) > 0. 

(c) D = 6 (mod 9) and ^3(2^2) > 2. 

(d) D = 6 (mod 9) and Vs{2v2) — V3{u4) — 1. 

(e) D = Q (mod 9), 'y3(2^;2) = 0, and = ±2v2 (mod 9). 

(f) ^3(^3) = 1 and there exists s = ±1 such that 2vi{D/3) = 5(^3/3 — 2a{D/3)) 
(mod 9) and 2vis ^ 2a/3 (mod 3). 

(g) f3('U3) = 1 and there exists s = ±1 such that 2vi{D/3) = s{u3/3 — 2a{D/3)) 
(mod 9), 2vis = 2a/3 (mod 3), V3{2v2) = 0, and D = 3 (mod 9). 

(h) ^3(^3) = 1 and there exists s = ±1 such that 2vi{D/3) = 5(^3/3 — 2a{D/3)) 
(mod 27), 2vxs = 2a/3 (mod 3), ^3(2^2) = 0, and D = 6 (mod 9). 

(i) V3{u3) = 1 and there exists s = ±1 such that 2viS = 2a/3 (mod 3), V3{2v2) > 0, 
and there exists t E {—1, 0, 1} and r E {—1, 0, 1} such that 

2vi{D/3) = s{u3/3 - 2a{D/S)) - 6v2{D + 3)t - 9{2vis - 2a/3)st^ 

- 3r{D{2vi + a/3) + 6rDvi + 6at'^) (mod 81) . 

This finishes the study of local solubility in the case of ramified primes, hence the section 
on local solubility. 

7. Examples 

7.1. The Curves y"^ = + {kpY for k = 1, 2, or 4. In this section we consider the 
family of curves Ekp with equation y'^ = x^ + {kpY, where p is a prime and k = 1, 2, or 4. 
The restriction on k is made so that no other prime apart from 2 divides it. Note that it 
is not necessary to consider higher powers of 2 since the curve y'^ — + (S/cp)^ is trivially 
isomorphic to the curve = + (/cp)^. Furthermore the primes p = 2 and 3 give rise 
to a finite number of curves which can be treated individually (specifically, for p = 2 the 
rank is equal to 0, for {k,p) = (1, 3) and (2, 3) the rank is 1, Mordell-Weil generators being 
(—2, 1) and (—3, 3) respectively, and for {k,p) = (4, 3) the rank is again equal to 0, and the 
torsion is always of order 3 generated by T = (0, kp), except for {k,p) — (4, 2), for which it 
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has order 6 generated by (8, 24)). We therefore assume that p > 5, so that in particular all 
of these curves have rational 3-torsion generated by T = (0, kp) equal to their full rational 
torsion subgroup. 

We first compute the image of a. For this, we consider the cubic equations of Theorem 
3.1 (3), in other words uiX^ + U2f^ + u^Z"^ = 0, where U1U2 \ 2kp and U3 = 2kp/{uiU2), 
where we recall that U1U2 is squarefree. Up to exchange of Ui and U2, it is easy to check 
that the only of possibilities are (1, 1, 2kp), (1, 2, kp), 2k), (1, 2p, k), and (2,p, k). The 
first one (corresponding to u — 1) gives an evidently soluble equation, corresponding to 
the unit element of the elliptic curve. 

• When k — 1, the fourth one (corresponding to u — 2p and u — 4p^) is also soluble, 
and it corresponds to the two nontrivial rational 3-torsion points on the curve, and 
the other three (corresponding to u = 2, 4, p, p^, 4p, and 2p^ , are equivalent. 

• When k = 2, the fifth one (corresponding to u = ip and u = 2p'^) is also soluble, 
and it again corresponds to the two nontrivial rational 3-torsion points on the curve, 
the second and fourth (corresponding to u = 2, A, 2p, and 4p^ are equivalent, and 
the third corresponds to u = p and p^. Since the set (of classes) of u for which the 
cubic is soluble forms a group and since 4p and 2p^ belong to this group, it follows 
that [p] and [p^] will be in the group if and only if 4 and 2 are, so in fact the three 
equations are equivalent, although slightly less trivially. 

• Finally, when k = 4 the third equation (corresponding to p and p^) is clearly soluble 
(since 2 A; = 8 is a cube), and this again corresponds to the two rational 3-torsion 
points. The other equations correspond respectively to m = 2 and 4, m = 2p and 
4p^, and u — Ap and 2p^, and once again because of the group structure all the 
equations are in fact equivalent. 

We see that in each case it is sufficient to consider the equation with Ui — 1, U2 — 2, 
hence — kp. The result is as follows: 

Lemma 7.1. Keep the above assumptions. The equation + 2Y^ + kpZ^ — is ELS if 
and only if k ^ 4, either p = 2 (mod 3) or 2^"^^/^ = 1 (mod 3), and kp ^ ±4 (mod 9). 

Proof. This of course immediately follows from the study of the equation that we have 
made above. More precisely, if A; = 4 the 2-adic valuations of the coefficients are (0, 1, 2), 
so the equation has no 2-adic solutions by Lemma 5.1. On the other hand, if /c = 1 or 
k = 2, the 2-adic valuations are (0,0,1) and (0,1,1) respectively, and since all elements 
of F2 are cubes, we conclude by Lemma 5.4 that the equation has a solution in Q2. For 
p-adic solubility we also use this lemma, since the p-adic valuations are (0,0, 1), and we 
conclude that the equation has a p-adic solution if and only if 2 is a cube in F*, leading to 
the given condition. Finally, since the 3-adic valuations are (0, 0, 0) we use Lemma 5.9 (1), 
which tells us that the equation has a 3-adic solution if and only if Ui = ±Uj (mod 9) for 
some i 7^ j, which gives kp = ±1 or ±2 (mod 9), in other words kp ^ ±4 (mod 9) since 
3\kp. n 
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Corollary 7.2. Let p > 5 be prime, let k = 1, 2, or 4, and let E be the elliptic curve 
= + {kpy. 

(1) For k ^ 1, if either p = ±4 (mod 9) or if p = 1 or 7 (mod 9) and 2^-^^^ ^ 1 
(mod p) then lin{a) — {1, 2p, Ap^}, and in particular |Im(Q;)| = 3. 

(2) For k = 1 and p = 2 (mod 9) we have |Im(Q;)| = 9. 

(3) For k = 2, if either p = ±2 (mod 9), or if p = 1 or 4 (mod 9) and 2^^-^^'^ ^ 1 
(mod p) then \m.{a) = {l,4p, 2p^}, and in particular |Im(Q;)| = 3. 

(4) For k — 4 we always have lm{a) = {l,p,p^}, and in particular |Im(Q;)| = 3. 

(5) In all other cases we have |Im(Q;)| = 3 or 9. More precisely the cubic equation 

+ 2Y^ + kpZ^ — Q is ELS, and |Im(Q;)| — 9 if and only if it is globally soluble. 

Proof. (1), (3), (4), and (5) are clear from the lemma by inspection. For (2), we use the 
proposition 3.3 p. 438 of Satge [17]. □ 



Remark. In [15], Rodriguez- Villegas and Zagier have characterized the primes which are 
sums of two cubes. If their method could be extended to primes which are of the form 
+ 2y^, and also of the form + iy^, it would determine Im(Q;) in all cases. 

We now compute the image on the dual curve E, whose equation is y"^ = — 27(A;p)^, so 
that D = —3 and b = 3kp. We first determine local solubility of the equation corresponding 
to p = (— 1 + \/^)/2, and for the moment we do not necessarily assume that A; | 4. 

Lemma 7.3. (1) Let k be such that 8 \ k. The equation corresponding to p is locally 
soluble at the primes 2, 3, and p if and only if p = ±1 (mod 9), k = ±4 (mod 9), 
and 4 | k. 

(2) In particular, if k = 1, 2, or A, the equation corresponding to p is ELS if and only 
if k = 4 and p = ±1 (mod 9) . 

Proof. We have 2vi — —1, 2v2 = 1, and 2b = Qkp, so = 2b/{vT{v)) = 6kp. The prime 
2 being inert, by Lemma 6.5, if 4 f A; the equation is locally soluble at 2 if and only if p is 
a cube in F4, which is not the case since the only cube is 1. On the other hand, if 4 \ k 
Lemma 6.6 tells us that the equation is locally soluble at 2. Let us now look at the prime 
p. If p = 1 (mod 3) then p is split, so by Corollary 6.3 the equation is locally soluble at p 
if and only if {vi + V2dp)X^ + (vi — V2dp)Y^ + GkpZ"^ = is, and since the p-adic valuations 
are (0, 0, > 1), by Lemma 5.4 this is true if and only if (fi + V2dp) /{yi — V2dp) = p^ / p = p 
(mod p) is a cube in F*, hence if and only if = 1 (mod p), which is the case if and 

only if p = 1 (mod 9). If p = 2 (mod 3) then p is inert, so by Lemma 6.5 the equation is 
locally soluble at p if and only if p is a cube in F*2, hence if and only if p^ = 1 (mod 9), 
in other words p = — 1 (mod 9) since we assume p = 2 (mod 3). It follows that the local 
condition at p is p = ibl (mod 9). Finally let us look at the prime 3. Since 2a = we 
use Lemma 6.11 (2), which tells us that the equation is locally soluble at 3 if and only if 
Qkp = ±3 (mod 27), or equivalently kp = ±4 (mod 9), proving (1) since p = ±1 (mod 9), 
and (2) follows immediately. □ 
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Next, we assume that p = 1 (mod 3). In this case we can write p = 7rr(7r) with 
TT = {wi + W2\f—^)/2 in 12 different ways, and it is well-known and easy that up to sign 
and exchange of tt and t{t:) there is exactly one such decomposition with 2>\w2. 

Lemma 7.4. Letp = 1 (mod 3), letn = {wi+W2y/—S)/2 be such that7iT{7i) = p, and let k 
be such that 8\ k, S\ k, andp\ k. The equation corresponding to tt is locally soluble at the 
primes 2, 3, and p if and only if either A\k or A \ k and 2 \ W2 E Z, if {'Wi/{2k))^~^^^^ = 1 
(mod p), and if either 3 | W2, or3\w2 and p=k'^ + 3 (mod 9). 

Proof. We have 2vi = Wi, 2v2 = W2, and = 2b/{vT{v)) = Qk. The prime 2 being 
inert, as above Lemmas 6.5 and 6.6 tell us that the equation is locally soluble at 2 if 
and only if either 4 \ k, ov 4 \ k and (wi + W2\/—3)/2 = 1 in F4, which is equivalent to 
2 I W2- By Corollary 6.3 the equation is locally soluble at p if and only if {vi + V2dp)X^ + 
{vi — V2dp)Y^ + QkdpZ^ — is. Since vf — v'^d'^ — p, we may assume for instance that 
dp is chosen so that Vp{vi — V2dp) = 1, so in particular V2dp = Vi (mod p). The p-adic 
valuations of the coefficients are thus (0, 1, 0), so by Lemma 5.4 local solubility is equivalent 
to (fi + V2dp) / (Gkdp) being a cube in F*, and since Vi = V2dp (mod p), this means that 
vi/{3kdp) = wi/{6kdp) is a cube in F*. This is equivalent to {wi/ {6kdp)y — —wl/{108k^) 
being a cube, hence to {wi/{2k)Y being a cube, hence to Wi/{2k) being a cube, leading 
to the given condition. Finally, let us look at the prime 3. Since 2a = we use Lemma 
6.11 (2), which tells us (since 3f /c, so that ^3(^3) = 1) that the equation is locally soluble 
at 3 if and only if either 3 \ W2, or if 6k = ±3wi (mod 27), in other words 2k = ±Wi 
(mod 9). However since wf + 3w2 = 4:p, ii 3 \ W2 we have wf = 4p — 3 (mod 9), and 
since the condition 2k = ±wi (mod 9) is equivalent to wf = 4fc^ (mod 9) (since 3 \ wi) we 
obtain the equivalent condition 4p = 4k^ + 3 (mod 9), or equivalently p = k^ + 3 (mod 9), 
finishing the proof of the lemma. □ 

Corollary 7.5. Let p > 5 be prime, let k — 1, 2, or 4, and let E be the elliptic curve 
y^^x^- 21{kpf. 

(1) For k — 1 or k — 2, if either p = 2 (mod 3), or if p = 1 (mod 3), p ^ A;^ + 3 
(mod 9), and 2*^^"^^/'^ ^ 1 (mod p) then Im(Q;) is trivial. 

(2) For k = 4, if p = 2 or 5 (mod 9) then Im(S) is trivial, 

(3) Otherwise, |Im(a)| = 1 or 3 when k — 1, k — 2, or k — 4 and p = 8 (mod 9), and 
|Im(a)| = 1, 3, or 9 when k — 4 and p = 1 (mod 3). 

Proof. Since 2b — 6kp, 2 is inert, and 3 is ramified, with the notation of Section 4.2, we 
must have fi — 1 if p = 2 (mod 3) and /i = 1 or p if p = 1 (mod 3). In the first case, 
the only possible v are 1, p, and p^, while in the second case we have in addition the three 
possible TT (up to sign and conjugation) such that 7rr(7r) = p. It follows that: 

• If p ^ Ini(Q;) and none of the three possible tt is in Im(a) then Im(a) = {1}, so 
|Im(a)| = 1, 

• If p ^ Im(a) and one of the three possible tt (so necessarily exactly one) is in Im(a) 
then Im(a) = {1, tt, T(7r)}, hence |Im(a)| = 3. 
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• If p G Im(a) and none of the three possible tt (in this case they are equivalent) is 
in Im(a) then lm{a) = {l,p, p^}, hence |Im(a)| = 3. 

• If p G Im(a) and one (hence all) of the three possible tt are in lm(a) then lm(a) — 
{p^p%,p^r(7r), < J < 2}, hence |Im(S)| = 9. 

Since in the two preceding lemmas we have studied local solubility of the equation in all 
these cases, we conclude by inspection. □ 

We can say a little more: 

Proposition 7.6. (1) Assume that k — 1 andp = 4 (mod 9), or that k — 2 andp = 7 
(mod 9), and write p = m? + 3n^, where m and n are integers which are unique 
up to sign. The equation corresponding to n = m + n^/— 3 (i.e., with vi — m and 
V2 = n) is ELS, and |Im(a)| = 3 if and only if it is globally soluble. 

(2) Assume that k — 4 andp = 8 (mod 9). The equation corresponding to p is ELS, 
and |Im(a)| = S if and only if it is globally soluble. 

(3) Assume that k = 4 and p = 4 or 7 (mod 9), and write 4p = + 27n^, where m 
and n are unique up to sign. The equation corresponding to n = {m + 3^^/— 3)/2 
(i.e., with vi = m/2 and vi = 3n/2) is ELS, and |Im(a)| = 3 if and only if it is 
globally soluble. 

Proof. Apply the same method as above. □ 

We will see below that it follows from BSD that these equations (of Proposition 7.6) 
should in fact always be globally soluble. 

Corollary 7.7. (1) Ifp = 5 (mod 9), orp = l or 7 (mod 9) anc?2(^"^)/^ ^ 1 (modp), 
the elliptic curve Bp with equation — -\- p^ has rank 0. If p = 2 (mod 9), it 
has rank 1. Otherwise, if p= 4 or 8 (mod 9) it has rank or 1, and if p = 1 or 7 
(mod 9) it has rank 0, 1, or 2. 

(2) If p = 2 (mod 9), or p = 1 or 4 (mod 9) and 2'^^^^^^'^ ^ 1 (mod p), the elliptic 
curve with equation y'^ = + 4p^ has rank 0. Otherwise, if p = 5, 7, or 8 
(mod 9) it has rank or 1, and if p=l or 4 (mod 9) it has rank 0, 1, or 2. 

(3) If p = 2 or 5 (mod 9) the elliptic curve E^p with equation y'^ = x^ + 16p^ has rank 
0. Otherwise, if p = 4, 7 , or 8 (mod 9) it has rank or 1, and if p = 1 (mod 9) it 
has rank 0, 1, or 2. 

Proof. Clear, since |Im(Q;)||Im(S)| = 3''+^. (No need of BSD here.) □ 

This corollary allows us to determine the rank exactly for instance with k — 1 ioi p — 61, 
79, 113, 131, 149, 151, 163, 293, etc., with k = 2 for p = 29, 83, 137, 139, 173, 181, 199, 
etc., and with /c = 4 for p = 41, 59, 101, 131, 137, etc... for which mwrank, at least in its 
basic version, is not able to determine the rank using 2-descent. 
Remarks. 

(1) We can use "the parity conjecture" in this context, see for example [10] and [11], 
in other words the analytic rank has the same parity as the algebraic rank, then 
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whenever in the above the rank is known to be equal to or 1 then it is always 
equal to 1, while when the rank is known to be equal to 0, 1, or 2 then it is always 
equal to or 2, and both cases occur. This has been proved in certain cases: as 
already mentioned, by Satge for k = 1 and p = 2 (mod 9), and in an unpublished 
work Elkies has shown that for A; = 4 and p = 4 or 7 (mod 9) the rank is indeed 
equal to 1. 

(2) The case k — 4 corresponds to primes which are sums of two cubes, so by [15] one 
knows that when p = 1 (mod 9) the rank is equal to or 2, and exactly for which 
primes it is equal to 2. It is possible that either their method or Elkies' can be 
extended to the cases k = 1 and k = 2. 

(3) The result for A; = 4 can also be proved, less naturally, using 2-descent; see Theorem 
6.4.17 of [4]. 

When the cubics are ELS, we may of course try to look for a global solution by search. A 
very efficient way of looking for rational points on a homogeneous cubic has been described 
by N. Elkies in [12], see also an unpublished preprint of J. Cremona on the subject. It 
has been implemented by several people. Using a slightly modified implementation due 
to M. Watkins, we can for instance find that a generator P = {x,y) of the Mordell-Weil 
group of — +p^ for p — 1759, which has rank 1, is given by 

_ 242479559514608433100075350499874221113923535 

^ ~ 3063551062176562878606796987394973602467684 
_ 8643240396318605197724619647046515784779281219388876514209037894857 

^~ 5362134274928159502186511847328850266140274118035321166956948248 
This generator is not found by mwrank even at a high search limit. On the other hand 
it could certainly be found using the Heegner point method. 

For a more complicated example, for p = 9511 the curve y'^ = + p^ has analytic 
rank 2, so the Heegner point method is not applicable, and mwrank even at a high search 
limit finds only the one-dimensional subspace of the (free part of the) Mordell-Weil group 
generated by Pi = (—210, 9011). Using our implementation, we find that the full free part 
has basis (Pi, P2) with P2 = {x,y), where 

_ 32701984517186448621442294824950874787830128281 

^~ 456289760665179363242981599270033206574137600 
_ 92890043770264171014255964610503972850176417273682124237369198272789821 

^ ~ 9746778232027925565271633950191532413151456450450966045051557376000 

In the following tables, we summarize what is proved (either using 3-descent as above, 
by Satge, in Elkies' unpublished work, or Rodriguez- Villegas-Zagier's work), what is a 
consequence of BSD, and what remains to be done. The tables are coded as follows. In the 
first column we indicate the residue of p modulo 9, and if relevant, in the second column 
we indicate the cubic character (^)g of 2 modulo p, 1 meaning that 2(f-i)/3 = I ^^^^ p-^^ 

and p, meaning of course 2^~^^^^ ^ 1 (modp). In the third, fourth, and fifth column 
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we give |Im(Q;)|, |Im(a)|, and the rank of the curve respectively, and when two values are 
given, both occur. In the last column, we give a pair of symbols (A,B), corresponding to 
(|Im(Q;)|, |Im(a)|), where P means proved, BSD means proved under BSD, S means Satge, 
ELK means Elkies, RVZ means Rodriguez- Villegas-Zagier, and U means unknown. 
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An immediate corollary of the above tables and of Corollary 7.2 and Proposition 7.6 is 
the following: 

Corollary 7.8. (1) Assume BSD. If p = 2 or 8 (mod 9) there exist x and y inQ such 
that p = x^ + 2y^, and if p = 5 or 8 (mod 9) there exist x and y in Q such that 
p^ x^ + Ay^. 
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(2) Assume that either k = 1 andp = 4 (mod 9) or that k = 2 andp = 7 (mod 9), and 
write p — + 3n^. If BSD is true the equation 

nX^ - 3mY^ + 3kZ^ + 3mX^Y - 9nXY'^ = 

is globally soluble. 

(3) Assume that p = 8 (mod 9). If BSD is true the equation 

X^ + 3Y^ + 2ApZ^ - 3X^Y - 9XY^ = 
is globally soluble. 

(4) Assume that p = A or 7 (mod 9), and write Ap — + 27 r? . Without any assump- 
tion the equation 

nX^ - mY^ + 8Z^ + mX'^Y - 9nXY^ = 

is globally soluble. 

Proof. Clear, since these correspond respectively to |Im(a)| = 9 under BSD, |Im(a)| = 3 
under BSD for (2) and (3), and to |Im(Q;)| = 3 by Elkies's result. □ 

7.2. The Curves — x^-\-{kpy for A; = 3 or 9. Once again the restriction on k is made 
so that no other prime apart from 3 divides it, and it is not necessary to consider higher 
powers of 3. Furthermore the primes p = 2 and p = 3 give rise to a finite number of curves 
which can be treated individually (specifically, the rank is zero unless {k,p) = (3,2), in 
which case it has rank 1, a Mordell-Weil generator being (—3, 3), and the torsion is of order 
3 generated by T = (0, kp), unless {k,p) = (9, 3), in which case it has order 6 generated by 
(18,81)). We therefore assume that p>5. 

As before, we first compute the image of a. For this, we consider the cubic equations 
of Theorem 3.1 (3), in other words uiX^ + U2Y^ + u^Z^ — 0, where uiU2 \ 2kp and 
^3 = 2kp/{uiU2), where we recall that uiU2 is squarefree. Up to exchange of ui and 
U2, it is easv to check that the onlv of possibilities are (1, l,2kp), (1,2, kp), (1, 3, 2A;p/3), 
{l,6,kp/3),\l,p,2k), {l,2p,k), (l,3p,2A:/3), (l,6p,A:/3), (2,3,A:p/3), {2,p,k), {2,3p,k/3), 
(3,p, 2/c/3), {3,2p,k/3), and {6,p,k/3). The first one (corresponding to u — 1) gives an 
evidently soluble equation, corresponding to the unit element of the elliptic curve. 

Consider first A: = 3. We obtain the equations (1.2.3p). (1.3.2/;). (l,6,p), (l,p, 6), 
(l,2p,3), (l,3p,2), (l,6p,l), (2,3,p), (2,p,3), (2,3p,l), (3,p,2), (3,2p,l), and (6,p,l). 
The equation (l,6p, 1) (corresponding to u = 6p and u = (6p)^) corresponds to the two 
3-torsion points of the curve. Apart from that, up to permutation of the Ui we have to 
study solubility for (l,2,3p) (corresponding to it = 2, 4, 3p, 9p^, 12p, and 18p^), (1,3, 2p) 
(corresponding to m = 3, 9, 2p, 4p^, 18p, and 12p^), (l,6,p) (corresponding to u — 6, 36, 
p, p^, 36p, and 6p^), (2,3,p) (corresponding to u — 12, 18, 4p, 2p^, 9p, and 3p^). 

Lemma 7.9. We have two cases : 

(1) If p = 2 (mod 3) all the above cubics are ELS, giving a total of 27 ELS cubics. 
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(2) If p = 1 (mod 3), then either both 2 and 3 are cubes in ¥*, in which case once 
again all the above cubics are ELS for a total of 27, or either 2 or 3 or both are 
non cubes, in which case only 9 equations are ELS. 

Proof. Using the lemmas that we have proved it is immediate to show that all the 
equations are soluble at 2 and 3. The only problem is at p, and by Lemma 5.4 the 
equations are also soluble at p if and only if the classes of 2, 3, 6, and 3/2 respectively are 
cubes in F*, and if p = 2 (mod 3) this is trivially true. 

Assume now that p = 1 (mod 3). We consider four cases, according to the cubic residue 
character of 2 and 3 modulo p. 

(1) If 2 and 3 are non cubes in F*, then either their product or their quotient is a cube, 
so we deduce that either (1, 6,p) or (2, 3,p) (but not both) is locally soluble, giving 
a total of 6 + 3 = 9 possible values of u. 

(2) If 2 or 3 is a cube in F* but not both, then 6 and 3/2 cannot be cubes, so we deduce 
that either (1, 2, 3p) or (1, 3, 2p) is locally soluble, giving again 9 possible values of 
u. 

(3) If both 2 and 3 are cubes in F* then all the equations are locally soluble, giving a 
total of 24 + 3 = 27 possible values of u, proving the lemma. □ 

Corollary 7.10. (1) If p = 2 (mod 3) then |Im(Q;)| = 3, 9, or 27 and assuming BSD 
we have |Im(Q;)| = 3 or 27 and the following are equivalent: 

(a) |Im(a)| = 27, 

(b) rk(^) = 2, 

(c) There exist x and y in Q such that p = + 6y^, 

(d) There exist x and y in Q such that p — 2x^ + 3y^, 

(e) There exist x and y in Q such that p = Ax^ + I2y^, 

(f) There exist x and y in Q such that p = 9x^ + 18y^. 

(2) If p = 1 (mod 3) and 2 and 3 are not both cubes in F* then |Im(Q;)| = 3 or 9, and 
assuming BSD we have |Im(Q;)| = 9 and rk(E) = 1, and furthermore for {a,b) — 
(1, 6), (2, 3), (4, 12), or (9, 18), there exist x and y in Q such that p — ax^ + by^ if 
and only ifb/a is a cube in F*. 

(3) If p = 1 (mod 3) and 2 and 3 are both cubes in F* then either Cttu is globally 
soluble, in which case the six conditions of (1) are again equivalent except that 
the second must be replaced by rk(£') = 3, or Cjro is not globally soluble, in which 
case |Im(Q;)| = 9 and ik[E) = 1, and exactly one of the equations p = x^ + 6y^, 
p — 2x^ + 3y^, p — 4x^ + 12y^, or p — 9x^ + 18y^ has a solution with x and y in Q. 

Proof. The assertions independent of BSD follow immediately from the above lemma. 
On the other hand, we have that if either p ^ 2 (mod 3) or p = 1 (mod 3) and 2 and 3 are 
not both cubes in F* we have |Im(Q;)| = 1, so that _ If p = 2 (mod 3) 

the root number of E is equal to +1, so assuming BSD the rank of E is even, so we have 
|Im(Q;)| = 3 or 27, and the result clearly follows in this case. If p = 1 (mod 3) the root 
number of E is equal to —1, so assuming BSD the rank of E is odd, so we have |Im(Q;)| = 9 
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when 2 and 3 are not both cubes, so the result also follows. Finally, if p = 1 (mod 3) and 2 
and 3 are both cubes, then |Im(Q?)| = 1 or 3, and it is equal to 3 if and only if C^,^^ (which is 
ELS) is globally soluble. Assuming BSD the rank of E is again odd, so we have two cases: 

• If C,ro is not globally soluble we again have |Im(a)| = 1, so we must have |Im(Q;)| = 9 
and rk(E) = 1. 

• If Ctto is globally soluble we have |Im(a)| = 3, so we must have either |Im(Q;)| = 3 and 
rk{E) = 1, or |Im(Q;)| = 27 and r\i{E) = 3. □ 

Note that although C^^ is ELS, it is not always globally soluble: the smallest p for which 
it is not is p = 3889, for which the 2-rank based mwrank program of Cremona tells us that 
the rank is equal to 1, and on the other hand {X,Y,Z) = (91,-211,19) is a solution of 
the (2,3,p) cubic so |Im(a;)| > 9, hence by the above if C^^ was globally soluble we would 
have rk(£') = 3, which is not the case. 

Consider now k = 9. We obtain the equations (l,2,9p), (1,3, 6p), (1,6, 3p), (l,p, 18), 
(l,2p,9), (l,3p,6), (l,6p,3), (2,3,3p), (2,p,9), (2,3p,3), (3,p,6), (3,2p,3), and (6,p,3). 
The equation (3, 2p, 3) (corresponding to u — 18p and u — 12p^) corresponds to the two 3- 
torsion points of the curve. Apart from that, up to permutation of the Ui we have to study 
solubility for (1,2, 9p) (corresponding to m = 2 and 4), (l,3,6j9) (corresponding to m = 3, 
9, 6p, and 36p^), (l,6,3p) (corresponding to u = 6, 36, 3p, 9p^), (1,9, 2p) (corresponding 
to u = 2p and 4]?^), (1, 18, p) (corresponding to u = p and p^), (2,3,3p) (corresponding 
to u — 12, 18, 12p, and 18p^), (2,9,p) (corresponding to u — Ap and 2p^), and (3, 6,p) 
(corresponding to u = 9p, 3p^, 36p, and 6p^). 

Once again, the equations are all locally soluble at 2. However, they are not all locally 
soluble at 3 (in fact (3, 6,p) is never locally soluble at 3), and using once again the local 
solubility results that we have proved, we obtain the following lemma: 

Lemma 7.11. (1) If p = 2 (mod 3), exactly two of the 7 above equations are ELS, 
giving always a total of 9 values of u. 
(2) If p = 1 (mod 3) and 3/2, 3, or 6 are cubes respectively for p = 1, 4, or 7 (mod 9), 

once again exactly two of the 7 above equations are ELS, giving always a total of 9 
values ofu. Otherwise, none are ELS, giving a total of 3 values ofu (corresponding 
to the 3-torsion points). 

Proof. The seventh equation is not locally soluble at 3, and the six others are ELS if and 
only if p = ±4 (mod 9) and 3 is a cube for (1, 3, 6p) and (1, 9, 2p), p = ±2 (mod 9) and 6 
is a cube for (1, 6, 3p) and (2, 9,p), or p = ±1 (mod 9) and 3/2 is a cube for (1, 18, p) and 
(2, 3, 3p), and the result follows. □ 
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